CVE-2026-76826 · Package
NO FIX YET · SEE WHAT TO DO
tsParticles' stable publish workflow pastes generated release-note text directly into a Bash echo command. Shell characters a contributor puts in that text can run commands on the maintainer's release runner, with access to the release token.
first public Jul 10, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
The exposure is in the project's own stable publish workflow, which runs when a maintainer starts a stable release from versions 4.0.0 up to 4.3.2. Teams that only consume the tsParticles npm package at runtime are not exposed through this flaw. Teams that copied the same release workflow pattern into their own CI should review it.
Not affected if consumes-package-only, no-stable-release-workflow
Who cares github-actions, npm, tsparticles
.github/workflows file that publishes stable releases and contains echo with steps.release.outputs.bodytsparticles version with npm ls tsparticles and compare it to 4.3.24.3.2tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAW_RELEASE.md. Contributor-controlled shell metacharacters in generated release-note text can therefore execute when a maintainer starts a stable release, allowing modification of generated artifacts or workspace scripts and affecting later release steps that hold GITHUB_TOKEN and write permissions. This issue is fixed in version 4.3.2.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.